1

I would like to create a Universal Group whose members are a mix of cross-forests users and groups.

In the following example, two forests are mentioned (US and UK) and two domains in each forest (GeneralStaff and Java):

For example, the universalDevelopers group may comprise of members from UK.Java.Developers and US.Java.Developers. Then, for example, there may be a group of universalSales which contains the users UK.GeneralStaff.John and US.GeneralStaff.Dave.

In UK forest at the minute, I can freely add members and groups from the UK. But there is no way to add members from the US forest, despite having a two-way trust in place... e.g. I can login with US members into UK and vice-versa.

A further complication is that, with a Universal group in the UK (which contains three domains), I can only add two of the three. It can't see the third.

Could people please provide some thoughts on why cross-forest groups can't be created and ways of 'seeing' all domains within a forest.

EDIT: This is on a combination of Windows 2003 and 2008 server. Answers can be regarding either. Thanks!

1 Answer 1

2

You can't add users from a trusted forest domain to a Universal Group. You would need to use a Domain Local Group. See Active Directory Group Scope. You don't mention what you want to use the groups for, so that's as much as I can suggest for use.

4
  • Side question for you. It seems quite counter-intuitive that a domain local group that is specific to a singular domain, has the ability to add users from another domain or even forest. Why is this?
    – Federer
    Oct 3, 2012 at 13:38
  • 2
    It's a misnomer really, the "Domain Local" portion is supposed to reference the fact that the group can only be used on resources in the local domain.
    – HostBits
    Oct 3, 2012 at 13:49
  • Ah I see. I'm relatively new to Active Directory and therefore learning only when I need to. Am I right in asserting that Global and Universal groups, unlike Domain Local, do not allow access to resources but rather allow in the organisation of users in a domain? Which would explain why cross-domain/forest users would be allowed access to resources in a given domain, assuming it trusts it.
    – Federer
    Oct 3, 2012 at 13:57
  • 2
    Not quite, any "scope" (domain local, universal, etc) could be used for access to resources if it is a "security" group. "security" groups get Security Identifiers, whereas a "distribution" group could not be used to give access to resources. "Distribution" groups would be used more so for creating email list serves in an email system.
    – HostBits
    Oct 3, 2012 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .